BRIEFRansomwarehighP65
Emperador ransomware publishes Brazilian GTL Concreto e Logística
GTL Concreto e Logística LTDA
Detected19 October 2026 · 11:02 UTC
Ransomware group Emperador listed Brazilian firm GTL Concreto e Logística, which produces concrete and runs logistics and construction operations, claiming to have stolen financial documents, personal and customer data, and employee credentials. The Latin American victim spans manufacturing, finance and transportation, so the leaked data could fuel fraud and further intrusion. Defenders should watch for credential-stuffing and invoice-fraud activity tied to this data.
CategoryRansomware
Severityhigh
Priority score65
Detected19 October 2026 · 11:02 UTC
Ransomware● 48
Ransomware Qilin publica al distrito escolar Llano Independent (EE. UU.)The Qilin ransomware group has listed Llano Independent School District, a US education victim, on its leak site. Though outside Latin America, a freshly published ransomware victim is actionable for tracking the group's TTPs, affiliates and potential regional spillover. Education sector targeting by RaaS crews continues to rise.Ransomware● 30
Ransomware iah6477 publica a la firma estadounidense McKenneysRansomware group iah6477 lists McKenneys, a US professional-services firm, claiming 295.9 GiB of stolen data. It is a fresh victim listing but falls outside the AR-LATAM and critical-infrastructure scope, so its defender relevance is limited to supply-chain awareness. No regional impact is indicated.Ransomware● 27
Ransomware n0n publica a una empresa de salud domiciliaria de EE. UU.The n0n leak site listed a US home healthcare services provider as victim #88, currently flagged as pending exposure, meaning files may be released shortly. Home healthcare firms hold sensitive patient and billing data, but the victim is unidentified and outside Argentina/LatAm, so regional defender value is limited. Worth a low-priority watch only if the victim is later named or if a LatAm subsidiary emerges.Ransomware● 72
Ransomware n0n publica a la brasileña Prafesta Embalagensn0n ransomware published Prafesta, a Brazilian packaging maker, exposing Sapiens ERP and Vetorh payroll data after an unpaid attack. The leak includes thousands of invoices, worker CPF IDs, bank certificates and eSocial government filings. Exposed CPFs and certs are strong fraud vectors for defenders.Ransomware● 80
Ransomware Redact publica a la energética estadounidense ONEOKThe Redact ransomware group listed ONEOK, Inc., a major US oil & gas pipeline and energy operator with ~$39.4B revenue, on its leak site. A confirmed listing signals data theft and potential operational disruption across critical energy infrastructure. Energy-sector defenders should treat this as a live extortion threat and watch for downstream/supply-chain impact.Ransomware● 48
Ransomware n0n publica al laboratorio dental BladeTech IncThe n0n group listed BladeTech Inc, a Missouri dental laboratory (CAD/CAM), exposing full patient names, case designs, CNC toolpaths and a 4.4 GB production archive dated September-October 2026. PHI leakage triggers HIPAA obligations and downstream patient privacy risk. Recent production files indicate an active, current compromise.